Skip to content

Commit 66854f8

Browse files
cconloncconlon
committed
CI: add Android FIPS Ready workflow with two-pass hash and BKS support
1 parent 0694686 commit 66854f8

1 file changed

Lines changed: 200 additions & 0 deletions

File tree

‎.github/workflows/android_gradle_fipsready.yml‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
name: Android FIPS Ready Gradle Build and Test
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ 'master' ]
8+
9+
concurrency:
10+
group: android-fips-${{ github.head_ref || github.ref }}
11+
cancel-in-progress: true
12+
13+
jobs:
14+
build_wolfcryptjni_fipsready:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Clone wolfcrypt-jni
18+
uses: actions/checkout@v4
19+
20+
# Free up disk space to prevent emulator from failing
21+
- name: Free up disk space
22+
run: |
23+
sudo rm -rf /usr/share/dotnet
24+
sudo rm -rf /usr/local/lib/android/sdk/ndk
25+
sudo rm -rf /opt/ghc
26+
sudo rm -rf /opt/hostedtoolcache/CodeQL
27+
sudo docker image prune --all --force
28+
df -h
29+
30+
# Get latest stable wolfSSL version for FIPS Ready download
31+
- name: Get latest wolfSSL stable version
32+
id: wolfssl-version
33+
run: |
34+
LATEST=$(curl -s -H "Authorization: token ${{ github.token }}" \
35+
"https://api.github.com/repos/wolfSSL/wolfssl/tags?per_page=100" | \
36+
grep -o '"name": *"v[0-9]*\.[0-9]*\.[0-9]*-stable"' | \
37+
head -1 | grep -o '[0-9]*\.[0-9]*\.[0-9]*')
38+
echo "version=$LATEST" >> $GITHUB_OUTPUT
39+
echo "wolfSSL stable version: $LATEST"
40+
41+
# Cache wolfSSL FIPS Ready archive
42+
- name: Cache wolfSSL FIPS Ready archive
43+
uses: actions/cache@v4
44+
id: fips-cache
45+
with:
46+
path: wolfssl-fips-ready.zip
47+
key: wolfssl-fips-ready-${{ steps.wolfssl-version.outputs.version }}
48+
49+
# Download wolfSSL FIPS Ready if not cached
50+
- name: Download wolfSSL FIPS Ready
51+
if: steps.fips-cache.outputs.cache-hit != 'true'
52+
run: |
53+
VERSION="${{ steps.wolfssl-version.outputs.version }}"
54+
URL="https://www.wolfssl.com/wolfssl-${VERSION}-gplv3-fips-ready.zip"
55+
echo "Downloading: $URL"
56+
wget -q "$URL" -O wolfssl-fips-ready.zip
57+
58+
# Extract wolfSSL FIPS Ready to expected location
59+
- name: Extract wolfSSL FIPS Ready
60+
run: |
61+
unzip -q wolfssl-fips-ready.zip -d /tmp/wolfssl-fips-extract
62+
EXTRACTED_DIR=$(find /tmp/wolfssl-fips-extract -mindepth 1 -maxdepth 1 -type d | head -1)
63+
echo "Extracted directory: $EXTRACTED_DIR"
64+
ls "$EXTRACTED_DIR/wolfcrypt/src/" | head -5
65+
mv "$EXTRACTED_DIR" IDE/Android/app/src/main/cpp/wolfssl
66+
67+
# Configure CMakeLists.txt for FIPS Ready build
68+
- name: Configure for FIPS Ready
69+
run: |
70+
sed -i 's/set(WOLFSSL_PKG_TYPE "normal")/set(WOLFSSL_PKG_TYPE "fipsready")/' \
71+
IDE/Android/app/src/main/cpp/CMakeLists.txt
72+
grep 'WOLFSSL_PKG_TYPE' IDE/Android/app/src/main/cpp/CMakeLists.txt
73+
74+
# Patch MainActivity to auto-trigger WolfCryptProvider on launch,
75+
# so FIPS error callback fires and prints the expected hash to logcat
76+
# without needing a button press.
77+
- name: Patch MainActivity for auto FIPS hash detection
78+
run: |
79+
sed -i 's/button.setOnClickListener(buttonListener);/button.setOnClickListener(buttonListener);\n\n try { testFindProvider(null); } catch (Exception e) { e.printStackTrace(); }/' \
80+
IDE/Android/app/src/main/java/com/example/wolfssl/MainActivity.java
81+
82+
# Setup Java with Gradle caching
83+
- name: Setup java
84+
uses: actions/setup-java@v4
85+
with:
86+
distribution: 'zulu'
87+
java-version: '21'
88+
cache: 'gradle'
89+
90+
# Build all targets
91+
- name: Gradle Build (pass 1 - placeholder hash)
92+
run: cd IDE/Android && ./gradlew --build-cache assembleDebug assembleDebugUnitTest assembleDebugAndroidTest
93+
94+
# Enable KVM for hardware acceleration
95+
- name: Enable KVM
96+
run: |
97+
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
98+
sudo udevadm control --reload-rules
99+
sudo udevadm trigger --name-match=kvm
100+
101+
# Cache AVD snapshot for faster emulator boot
102+
- name: AVD cache
103+
uses: actions/cache@v4
104+
id: avd-cache
105+
with:
106+
path: |
107+
~/.android/avd/*
108+
~/.android/adb*
109+
key: avd-wolfcryptjni-fips-30-x86_64-google_apis-v1
110+
111+
# Create AVD and generate snapshot for caching
112+
- name: Create AVD and generate snapshot
113+
if: steps.avd-cache.outputs.cache-hit != 'true'
114+
uses: reactivecircus/android-emulator-runner@v2.37.0
115+
with:
116+
api-level: 30
117+
arch: x86_64
118+
target: google_apis
119+
force-avd-creation: false
120+
emulator-options: -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
121+
disable-animations: true
122+
script: echo "Generated AVD snapshot for caching"
123+
124+
# Launch app briefly to capture FIPS in-core hash from logcat.
125+
# The FIPS error callback prints the expected verifyCore hash on
126+
# startup if there is a mismatch.
127+
- name: Capture FIPS in-core hash
128+
id: fips-hash
129+
uses: reactivecircus/android-emulator-runner@v2.37.0
130+
timeout-minutes: 5
131+
with:
132+
api-level: 30
133+
arch: x86_64
134+
target: google_apis
135+
force-avd-creation: false
136+
emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
137+
disable-animations: true
138+
script: |
139+
adb wait-for-device
140+
adb logcat -c
141+
cd IDE/Android && ./gradlew installDebug --no-daemon --no-watch-fs
142+
adb shell am start -W -n com.example.wolfssl/.MainActivity
143+
sleep 10
144+
adb logcat -d > /tmp/logcat_hash.txt 2>&1
145+
HASH=$(grep -o 'hash = [A-Fa-f0-9]\{64\}' /tmp/logcat_hash.txt | head -1 | sed 's/hash = //') && echo "Captured FIPS hash: $HASH" && echo "hash=$HASH" >> $GITHUB_OUTPUT || echo "hash=" >> $GITHUB_OUTPUT
146+
test -z "$HASH" && echo "WARNING: No FIPS hash found in logcat, dumping wolfssl lines:" && adb logcat -d -s System.err | tail -20 || true
147+
148+
# Update FIPS hash in CMakeLists.txt and rebuild if needed
149+
- name: Rebuild with correct FIPS hash
150+
if: steps.fips-hash.outputs.hash != ''
151+
run: |
152+
HASH="${{ steps.fips-hash.outputs.hash }}"
153+
echo "Updating FIPS hash to: $HASH"
154+
sed -i "s/WOLFCRYPT_FIPS_CORE_HASH_VALUE=[A-Fa-f0-9]*/WOLFCRYPT_FIPS_CORE_HASH_VALUE=$HASH/g" \
155+
IDE/Android/app/src/main/cpp/CMakeLists.txt
156+
cd IDE/Android && ./gradlew --build-cache assembleDebug assembleDebugUnitTest assembleDebugAndroidTest
157+
158+
# Generate BKS KeyStore files for PKIX tests
159+
- name: Generate BKS KeyStore files
160+
run: |
161+
BCPROV_URL="https://repo1.maven.org/maven2/org/bouncycastle/bcprov-jdk18on/1.78.1/bcprov-jdk18on-1.78.1.jar"
162+
wget -q "$BCPROV_URL" -O /tmp/bcprov.jar
163+
cd examples/certs && ./convert-to-bks.sh /tmp/bcprov.jar
164+
165+
# Run instrumented tests on Android emulator
166+
- name: Run Android Instrumented Tests
167+
uses: reactivecircus/android-emulator-runner@v2.37.0
168+
timeout-minutes: 15
169+
with:
170+
api-level: 30
171+
arch: x86_64
172+
target: google_apis
173+
force-avd-creation: false
174+
emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
175+
disable-animations: true
176+
script: |
177+
adb wait-for-device
178+
adb shell mkdir -p /data/local/tmp/examples/certs/intermediate
179+
adb shell mkdir -p /data/local/tmp/examples/certs/rsapss
180+
adb shell mkdir -p /data/local/tmp/examples/certs/crl
181+
adb push ./examples/certs/ /data/local/tmp/examples/
182+
adb logcat -c
183+
cd IDE/Android && ./gradlew connectedDebugAndroidTest --no-daemon --no-watch-fs || { adb logcat -d > /tmp/logcat.txt 2>&1; echo "=== LOGCAT (errors) ==="; grep -i "exception\|error\|fatal" /tmp/logcat.txt || true; exit 1; }
184+
adb logcat -d > /tmp/logcat.txt 2>&1 || true
185+
pgrep -f '[q]emu-system' | xargs -r kill -9 2>/dev/null || true
186+
pgrep -f '[c]rashpad' | xargs -r kill -9 2>/dev/null || true
187+
sleep 2
188+
189+
# Upload test reports even on failure
190+
- name: Upload Test Reports
191+
uses: actions/upload-artifact@v4
192+
if: always()
193+
timeout-minutes: 5
194+
with:
195+
name: android-fips-ready-test-reports
196+
path: |
197+
IDE/Android/app/build/reports/androidTests/
198+
/tmp/logcat.txt
199+
/tmp/logcat_hash.txt
200+
retention-days: 14

0 commit comments

Comments
 (0)